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Abstract 

We had recently shown that every positive integer can be represented uniquely using a recurrence se¬ 
quence, when certain restrictions on the digit strings are satisfied. We present the details of how such 
representations can be used to build a knapsack-like public key cryptosystem. We also present new dis¬ 
guising methods, and provide arguments for the security of the code against known methods of attack. 

1 Introduction 

One of the first public key cryptosystems was the traditional knapsack code proposed by Merkle and Heilman 
[11]. This code has the advantage of fast encoding and decoding. Also, in more recent developments, it has 
been shown that a quantum computer could make factoring large numbers fast enough to make the RSA 
code insecure [15, 10]. However, it appears that quantum computers would still struggle to make knapsack 
problems fast to solve [1]. 

Unfortunately, the traditional knapsack code was broken by two different approaches - by reversing the 
disguising steps [14] and by a direct attack using lattice-based approaches [8]. We describe a new type 
of knapsack-like code along with new disguising techniques, which make the code resistant to both these 
classes of attacks. We first give a brief description of the traditional knapsack code and its weaknesses. 

1.1 The traditional knapsack code 

The plaintext message is assumed to be an integer M, 0 < M < 2 n . We consider the representation of M 
in base 2: 

n—1 

M = ^ £l 2\ 0 < ej < 1. (1) 

»=o 

The creator of the code chooses a secret, superincreasing sequence {«,}, i.e., where .s, > Sj_i + • • • + so- 
The secret s, are then disguised by one or more modular multiplications of the form 


Wi = ksi (mod m), (2) 

where k and m are kept secret. The Wi are made public. The sender of the message M computes 


n—1 

T = (3) 

i =0 

The encoded message T is then sent over a possibly insecure channel. The hope was that only the creator 
of the code, who knows k,m, and the s*, can solve Equation (3) for the coefficients e,. In particular, the 
disguising step given in Equation (2) is easily reversed. 
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Shamir was able to break this code by calculating k and m and thus reversing the disguising [14]. 
Although the Wi appear random, the fact that the Sj are superincreasing can be exploited to yield enough 
clues to determine k and m, or at least equally useful alternative values. 

The other attack, which has received the most attention, tries to solve Equation (3) directly using 
lattice-based approaches [8, 2]. In essence, the solutions to Equation (3) correspond to a lattice of vec¬ 
tors. Basis reduction algorithms are efficient methods to find short vectors in, and short bases of, lattices 
[9, 7]. Although not guaranteed to do so, these approaches often find a shortest vector in the given lat¬ 
tice [3]. A weakness in using the base-2 representation of the message M is that the corresponding vector 
e = [eo ei • • • e n _i] from Equations (1) and (3) is likely to be the unique shortest vector in an appro¬ 
priately defined basis. 

For example, if n = 1000, the size of M is roughly 2 1000 . After using the s, and disguising to create the 
Wi (using Equation (2)), the target sum T might be of size 2 1030 (depending on the number of disguising steps 
used). The expected length of the true decoding vector e = [eo ei • • • eggg] 7 is 500 (for simplicity, we 
talk about the square of the length here). The number of 0-1 1000-vectors of length less than 500 is roughly 
2 999 . Hence the probability of any one of them equaling T is 2 -31 . In practice, approaches using basis 
reduction may find vectors with some e* = — 1 or e* = 2, and so on. We may penalize such solutions in 
these approaches, but cannot forbid them. But allowing such e, values tend to produce longer vectors. Thus 
it is indeed likely that the shortest vector in the lattice is the true decoding vector. In our new knapsack-like 
code, we try to prevent such lattice-based approaches from being effective. 

2 A Code Using Recurrence Sequence Representations 

Hamlin and Webb recently presented a description of how to find a unique representation of any positive 
integer using a recurrence sequence {iq} as a base [4]. We now show how to create a knapsack-like public 
key code using such representations. We illustrate our construction on a small example, and refer the reader 
to the above paper [4] for the complete proofs of all assertions. 

2.1 An example code 

Let Ui satisfy the recurrence u,+r, = tq +4 + u r +2 + 2u , + 1 + 7rq (the initial values are not vital, and we 
could take them to be the standard ones, i.e., uq = 1, u\ = 1, U 2 = 1, «3 = 2, and = 4). The signature is 
S = 10127. The representation of any positive integer M is of the form 


n —1 

M = ^2<iiUi, (4) 

i=0 

where the string of digits d n _id n _2 ■ ■ ■ dido must be composed of blocks of digits which are lexicograph¬ 
ically smaller than S. In this case, the allowed blocks of digits are 0,100,1010,1011, 10120,10121, 
10122,10123,10124,10125,10126. Hence, for instance, 101111023|0| 1010 is a legitimate string, but 
1010| 110123100 is not. Notice that no allowed block begins with 11. 

We now illustrate how to calculate this type of representation of any number M using a greedy approach. 
Although this calculation is straightforward, the fact that makes this code harder to model for the cryptan¬ 
alyst is that so many strings of digits are not allowed in the representations, even though the strings appear 
similar to the allowed ones, and both classes of strings use digits of the same size. 
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2.1.1 Computing the representation of M 


An easy way to calculate the representation of any number M in the recurrence sequence {rq} is to calculate 
the augmented sequence {vj^} for 1 <3< 10 , 0 < i < n given by 


th ,i — Uii 

^2,a — 'Ui “b Ui— 2, 

v 3,i = u i + Ui-2 + Ui—3, 

VA,i = Ui+Ui-2 + 2Ui- 3 , 

^5,a — ^a “b ^a—2 “b 2 Ui— 3 ~b Ui— 4, 


^ 10 , a — 'U'i —2 “b 2iUi —3 ~b 61 ^ 2 — 4 . 


The Vj i correspond to the allowed blocks of digits. In our example, the Vjj occur in groups of size 10. In 
other examples, the groups could be much larger. 

The correct expression for M is found simply by using the greedy algorithm on the v hl , and converting 
the sum into an expression in the Ui. The v ]A could be calculated and stored, or calculated from the u r as 
needed. 

We explore the memory requirements for storing all the {vj^}. The principal eigenvalue of the sequence 
{rq} is a « 1.9754. We may assume that u, is roughly a\ or is close to 2*. After disguising, the public 
weights Wi will be approximately 2 n+40 , and the target T approximately 2" +50 . In other words, these 
quantities require 40-50 extra bits of memory to represent. If n = 1000, the memory required for the 
weights Wi is roughly 1,040, 000 bits (or 130 kilobytes). The memory required to store all the Vj, t is hence 
1.3 megabytes. Even if n is much larger, the memory needed for the Wi is negligible. 

2.2 Encryption and decryption 

Let {rq} be a recurrence sequence that satisfies the following recurrence equation. 


(5) 


Ui — G\Ui —1 ~b CL2'U , i—2 “b * * * "b Gh'U'i—h 


where Gq > 0 and all a* > 0. The string S = a\a2 ■ • • ah is its signature, and we let A = aq + 02 + • • • + ah- 
Every natural number N has a unique representation in the form of Equation (4), where the digits are 
composed of blocks that are lexicographically smaller than S. Including the zero block, there are A such 
blocks. The auxiliary sequence {vj^} is constructed as linear combinations of the Ui with coefficients same 
as the blocks other than the zero block. Hence there are A — 1 of the Vjj in each group. The total number of 
Vj t i numbers is hence (A — 1 )n if there are n of the Ui. 

The creator of the code chooses a secret sequence { s t } which has the property that Sj + i > s, ('«?:+1 /ik) 
for all i. This property replaces the condition of { s ,} being superincreasing as used in the traditional knap¬ 


sack code. 


The Si are then disguised by any invertible mapping, some of which we describe below. The resulting 
quantities Wi are the public weights. If M is the original plaintext message, the user of the code expresses 



( 6 ) 


and computes 


72—1 


72—1 



(7) 
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which is the transmitted message. 

Since the mappings used for disguising are invertible by the code’s creator, she can calculate 


71—1 

N = Y J d i 

i =0 


n —1 


Si = 


e j,i tj,i- 


i =0 


( 8 ) 


We must show that she can solve Equation (8) for the same digits di as appearing in Equation (6). The tji 
and yjj are combinations of the s t and u>i, respectively, in the same way as v 3J are combinations of the iq. 
Also, each e 33l = 0 or 1, and for each i, at most one f. 3J = 1. 

In the greedy algorithm to express N using the tjj, we subtract the largest possible t 3 j from N at each 
step, and repeat the process on the remainder. If the correct tj^ have been used previously, we have an 
equation at each step that is essentially of the same form as Equation (8). That is, we know the number N' 
and that 

k 

N = e j,i tj,ii (9) 

i =0 


where the corresponding number 


k 

d/ = V ( j.i I'j.i 

i =0 


is used when expressing M. We rewrite Equations (9) and (10) as 


( 10 ) 


A — tj 3 + tj 2 + tj 3 + • • • , and (11) 

M’ = Vj x + Vj 2 + vj 3 + • • • , (12) 

where j\ > j 2 > jz > ■ ■ ■. In other words, we include only the terms for which e Jt i = 1. 

From Equation (11), we get tj t < N'. Hence the greedy algorithm will use tj 1 unless the next larger 
number in the sequence t 3l +\ < N', in which case t :n + \ would be used. By the definition, t 3l + \ = t 3l + s q 
for some s q . Also, v 3l + \ = v 3 , + u q , but Vj 1+ \ was not used in expressing M'. Hence it must be true that 
Vj 1+ 1 = v n + u q > M', whereas t 3i + s q < N'. 

Now we replace the tj and Vj by their corresponding combinations of the Sj and u 3 , respectively, as 
follows. 

s q < N' — tj 3 = tj 2 + tj 3 + • • • = hiSq + & 2 s i 2 + • • • j and (13) 

u q > M’ - v 3l = Vj 2 + Vj 3 H- = b\u i3 + b 2 Ui 2 H-. (14) 

Since q is larger than any of the i r in Equations (13) and (14), and since the Si were chosen so that 
Si/si+i < Ui/ui+i, from Equations (13) and (14) we have 


1 < hts^/sq) + b 2 (s i2 /sq) H-< &i(nq /u q ) + b 2 {u i2 /u q ) H-< 1, 

which is a contradiction. Hence the greedy algorithm will indeed use t 31 . 


3 Disguising Methods 

As described above, the plaintext message M can be expressed either as diUi or as e 3J v 3J: where 
ejj = 0 or 1, and can be calculated using a greedy algorithm. The sequence { s 1: } is chosen with the related 
auxiliary sequence {tjj}, which corresponds to the v 33 . Then, if M is expressed as in Equation (6) and N 
as in Equation (8), the creator of the code can calculate the e 3/l from knowing N, and can thus compute 
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M. A disguising method that maps s t into w r is invertible if given T as expressed in Equation (7), she can 
compute the number N. The yj j:l are defined in terms of the Wi, and in the same way t JA are defined in terms 
of Si and Vjj in terms of u t . 

Let E = max Y where the maximum is taken over all expressions of possible messages M. If n is 
the number of the U{ then E < n since using a greedy algorithm as described, at most one v J:l in each of n 
groups is used. With more careful analysis we can show that E is much smaller than n, but that result will 
not be critical for our analysis. 

For example, in the usual modular multiplication, Wi = csi (mod in) or s t = cwi (mod m). Then 

cT = ^2 diCWi = ^2 diSi = N (mod m). 

i i 

The number N is uniquely determined if N < m, which is true if m > E maxjf^j}. Thus, it suffices 
to take m > Es n . Since the Wi are defined modulo m, the w t are larger than the .sy by a factor of Es n . As 
such, the Wi require log 2 (i7s n ) bits to express in base 2. This expansion in the size of the disguised weights 
by log 2 (E) bits turns out to be similar in each stage of the disguising. 

As described earlier in Section 1.1, the nature of modular multiplication and the fact that some of the s* 
are very small give the cryptanalyst a way to possibly compute the parameters c and m. We now describe 
some alternative disguising methods and indicate why they could not be reversed by the cryptanalyst. 

First, perform an ordinary modular multiplication so that all the obtained values are of roughly the same 
size. Take any collection of pairwise prime moduli. For simplicity, we could use distinct primes p/. for 1 < 
k < r. Replace the weight w\ by the r-vector W; = [wi (mod pi) Wi (mod p 2 ) • • • Wi (mod p r )] T . 

Then the j ^ component of 

= ^2diWi (mod pj). (15) 

i i 

Hence we can use the Chinese Remainder Theorem to compute Yi diWi (mod pi.. .pk), and so the nu¬ 
merical value of Yi diWi is determined if p\ ... pk > AE max{«)j}. Again, the number of bits needed to 
express the vector W, is log 2 {AE m;ix{u;,}) more than the number needed to express the w t . 

We can do two stages of this type of mapping, the first one with large moduli mi and m 2 resulting 
in vectors of the form H <] for the original weight The second stage uses a large number of small 
primes separately on w[ and w". These primes could be the same or different for w[ and <■ In fact, we 
could simply take pi = 2,p 2 = 3,p3 = 5, and so on. 

Since each of the two residues modulo m\ and m 2 are disguised in this way, we have two lists of residues 
modulo 2 and 3 and 5, and so no. The creator of the code can choose a secret permutation of these residues. 
When there are k primes pi,... ,pk, each weight is a vector of dimension 2k. A cryptanalyst could easily 
see from the size of the components whether a given component is modulo 2 or modulo 3, and so on. But 
he cannot know which of the two residues modulo p, came from the rn 1 branch and which from the m 2 
branch of the disguising method. There are 2 k possible choices here. Although it is easy to use the Chinese 
Remainder Theorem on any such choice, making even one incorrect choice will produce incorrect residues 
modulo m\ and m 2 . Further, the values mi and m 2 are not known to the cryptanalyst. Thus the security of 
the disguising rests on the large number of permutations of the residues modulo pj, and not on the difficulty 
of solving a particular type of calculation. 

This method can be combined with other mappings as well. Another strong candidate is using modular 
multiplications in the rings of algebraic integers [13]. This step also turns each ordinary integer weight into 
a vector of dimension k, where k is the degree of the algebraic extension used. A sequence of such steps can 
be represented as a tree. Each sequence of steps corresponds to a different tree, a different set of parameters, 
and a different system of equations describing these parameters. Even if we assume that a cryptanalyst could 
obtain information about the disguising mapping from a system of such equations, he does not even know 
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what system of equations is the correct one to solve. The number of such possibilities could be made as 
large as we wish. Note that the final public weight vector consists of the leaves of the corresponding tree, 
which could also be secretly permuted. Thus the cryptanalyst does not know the correct permutation nor 
the correct tree model to use. Any incorrect choice results in a nondecoding result, as a consequence of the 
Chinese Remainder Theorem. 


4 Cryptanalysis 


The disguising methods we just described makes an attack that hopes to reverse the disguising steps quite 
unlikely to succeed. But even for the traditional knapsack code, attacks that try to solve Equation (3) directly 
using basis reduction algorithms [8,2] have posed the greater threat to security. 

Solving Equation (3) along with the constraints that e* = 0 or 1 could be modeled exactly using inte¬ 
ger optimization methods. While directly solving these instances with just this single constraint could be 
difficult even for moderate values of n, basis reduction-based reformulations could be more effective [6]. 
But adding more constraints makes the integer optimization instances increasingly hard to solve even when 
we have only a few hundred weights, e.g., see the recent work on basis reduction-based methods to solve 
market split problems [16]. Solving Equation (7) with very complex constraints and thousands of weights 
appears impossible using current methods. 

Direct basis reduction-based approaches, as opposed to integer optimization approaches, can handle 
much larger problems. But these methods cannot impose strict adherence to the constraints as the integer 
optimization models do. Instead, these algorithms find short vectors in appropriately defined lattices, which 
correspond to solutions of Equations like (3) and (7). In the case of Equation (3), the shortest vector in 
the lattice is the desired vector of e t , even though the basis reduction-based methods are not guaranteed to 
find this particular vector. Indeed, the shortest vector problem (SVP) and the closely related closest vector 
problem (CVP) are known to be hard problems. CVP is known to be NP-complete, and so is SVP under 
randomized reductions [12]. Still, such algorithms are often successful in practice to solve the problem 
instances exactly [3]. 

Most basis reduction-based approaches on the default knapsack code in Equation (3) start by defining an 
appropriate lattice in which the shortest vector corresponds to the correct decoding message. For the subset 
sum problem with weights w r and the target sum T, Coster et al. [2] consider the lattice generated by 


c w T cT 
21 1 ’ 


(16) 


where w is the vector of weights Wi, I is the n x n identity matrix, and 1 is the n-vector of ones. When 
the multiplier c is chosen large enough, the vector e corresponding to the correct decoding will generate 
the shortest vector in this lattice by multiplying the first n columns of C by e and the last column by — 1. 
This shortest vector has a length of x/n. To locate this shortest vector, one tries to find short(est) vectors in 
the lattice C. While it is not guaranteed to find the correct decoding vector in every case, these algorithms 
succeed with high probability when the density of the knapsack, defined as n/(max* log(u;j)), is small. 
When n is of the order of a few hundreds, these methods have been shown to be effective in finding the 
correct decoding [5]. 

To see how these methods might be applied to our code, we examine the example described in Section 
2.1. The cryptanalyst has the choice of trying to solve either 

n —1 n —1 

T = ^2 diWi or T = ^ e jt i y jti . ((7) revisited) 

2=0 z =0 
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We examine both possibilities by first calculating the expected lengths of the vectors d = [do ■ ■ ■ & n - t] T 
of dimension n = 1000 and the vector e of values of length lOn = 10 4 . It is not clear how one 
would add constraints forbidding the particular substrings of digits that are not permitted in d in the former 
approach. While one could potentially model all constraints forbidding nonallowed combinations of e,j 
in the latter approach, this step would produce a candidate lattice £ in which the single knapsack row is 
replaced by a substantially large number of simultaneous linear Diophantine equations. Hence the original 
basis reduction-based methods will struggle to find the correct decoding vector in this case as well. We 
could add one further level of difficulty in modeling the correct lattice C for the latter approach using 
We could slightly alter M by adding a small number M, or by using 2 M or 3 M instead of M, so that the 
expected length of the decoding vector becomes longer. The value M, or the multiplier, is sent in the clear, 
and should not affect the security of the code. 

Further, since the first few groups of the Vjj do not have the same number of elements, it is convenient 
to start with, say, U 20 instead of uq. In the encoding process, the remaining values smaller than v /20 are 
also sent in the clear. This modification also makes the choice of the sequence of s t easier to make, without 
increasing the size of the final public weights much. Sending these small values in the clear does not change 
the efficiency of the code significantly. 

In the encoding procedure, suppose at some stage we have the value M' as in Equation (10). If M' 
falls randomly in the interval [u k ,u k+ i), we first calculate the probability that Vjj. < M' < Then 

we calculate the probability that M' — v 3tk falls in a particular smaller interval [ue,ug+ 1 ). Recall that the 
associated principal eigenvalue is a « 1.9754, and we may approximate u k by a k for large k. There are 10 
subintervals to consider. Letting Vj jk = v j temporarily for ease of notation, the intervals arc I\ = [iq, V 2 = 
Vi + Uk- 2 ), h = [V2, V 2 + Uk- 3 ), h = [tt 3 , V 3 + Uk- 3 ), and I 3 = [vj, v 3 + u k - 4 ) for 4 < j < 10, where 
ffio + Uk-4 = ffic+l- 

If h < k — 5, then M' — v 3 , k € [uh,Uh+i) can occur in any of the 10 subintervals. If h = k — 4, 
then M' — Vj k € [u k -±, u k - 3 ) can occur only in intervals Ii, I 2 , or 1^, and M' — v 3 k € [u k - 3 , u k - 2 ) can 
occur only in I\. Hence the probability that M' — u k € [u k - 5 , u k ~ 4 ) is 10 (iifc _4 — u k - 5 ) / {u k+ 1 — u k ) « 
10a -5 , while the probability that M' — u k € [ztfc— 4 , 3 ) is 3(u k _3 — u k _ 4 ) / (u k + 1 — u k ) « 3a -4 . If 

M' € [u k , u k+ 1 ) and M' — u k G [u k , Uh+\ ), then there arc k — h — 1 groups of the v J3 that are skipped, 
i.e., they are not present in the representation of M'. Then the expected number of skipped groups between 
each pair that does appear is approximately 


k —5 

10 a h ~ k (k-h- 1) + 3a -4 (3) + a -3 (2) 

h =0 
k 

= 10 a ~ j (j - 1) + 9a -4 + 2a -3 

j=5 

w 10 (a -3 + 3(a - l)a -4 / (a - l) 2 ) + 9a -4 + 2a -3 
« 3.383 + 0.591 + 0.259 = 4.233. 

Therefore the expected number of groups represented when expressing M is n / 5.233, or 191 when n = 
1000 . 

In this example, M ~ a 10(10 ~ 5.5 x 10 295 ~ 2 982 . After the disguising steps described above, the size 
of the target sum T in number of bits needed is about 1030. There are then 2 1030 « 10 31 ° possible target 
objects or vectors. Even if we use extra disguising steps, the number of target objects might be as large as 
10 325 . 

We expect the representation of M to use some v l , J from 191 of the 1000 groups. As described above, 
we can easily alter M slightly to make sure at least 191 groups are used, i.e., the vector corresponding to the 
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correct decoding has length at least 191. If we look at shorter vectors, say of length 180, consisting of one 
Vij from 180 different groups, there are 


1000 

180 


10 


180 


10 


,383 


such vectors. Thus we expect 10 383 ~ 325 = 10 58 of these vectors to yield the same T. There are many even 
shorter vectors that yield T. If a basis reduction-based method finds the shortest vector yielding T, it will 
not be the one needed to decode T. If the method finds some short vector at random, the chance that it is the 
coricct decoding vector would be much smaller than 10 -58 . 


Now suppose the cryptanalyst tries to solve Equation (7) directly for the vector of digits d instead. The 
candidate vectors have dimension 1000 now, but the entries may be as large as 6. 

To compute the expected length of d, we need to calculate the expected value of each digit. By the 
calculations described above, we expect 191 of the 10 blocks 100,1010,... , 10126 to appear. The 
block is used if M is in the interval Ij described above. Hence the block 100 is used with probability 
Uk- 2 / (itfc+i — Uk) ~ a -2 / (a — 1), 1010 and 1011 appear with probability a~ 3 /(a — 1), and the other 7 
blocks with probability aT 4 /(a — 1). 

Among the 1000 digits di, we expect roughly 475 zeros, 370 ones, 103 twos, and 13 each of 3,4, 5, and 6. 
The expected length of the vector is 1900. There are more than 10 441 vectors of length 1550 consisting of 200 
zeros, 500 ones, 150 twos and 50 threes. There exist even more shorter vectors. Since there are only 10 325 
target vectors, we expect many shorter vectors to correspond to the same value T. Thus, unless it is possible 
to force the basis reduction-based algorithms to exclude vectors that do not correspond to allowable strings 
of digits, these methods will yield shorter vectors that do not correctly decode the encrypted message T. 
Integer optimization-based methods could exclude nonallowed vectors, but they could not handle problems 
of this size. 

The example code presented above is actually smaller and simpler than one that would be suggested for 
use. Indeed, one could take n as large as 10 5 without needing too large an amount of memory, and A as 
large as 100 or 1000. This setting would require the cryptanalyst to solve problems with 10 8 vectors if he 
used the version of Equation (7) with yj^. 


5 Discussion 

We have described how to use recurrence sequence representations to create a knapsack-like public key 
code. There is considerable freedom in the choice for the encoding sequence {rq}, as well as its order h, 
the size and pattern of the coefficients a 3 , and the number of terms n. Larger orders and coefficients create 
more false short vectors and hence increase the complexity of cryptanalysis. However, they also increase 
the size of rq and the weights wq. Questions about optimal choices for these parameters remain for further 
study. 

Another relevant question is whether specific number theoretic properties of such representations could 
be used to make this code even more secure. In particular, security against attacks targeting the represen¬ 
tation using Qj relies of the size of the instances, which could not be handled by state of the art methods. 
But could we make such attacks less feasible, or even impossible to mount, using inherent properties of the 
sequence used for the representation? 
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